Thrive TRM — CCPA FAQ Frequently Asked Questions Is Thrive TRM, LLC CCPA Compliant? How does Thrive TRM, LLC protect users’ privacy and keep that information secure? Is the Thrive TRM, LLC CCPA policy specific only to Californians? How can I exercise my Personal Privacy Rights with Thrive TRM, LLC? How can I exercise my Personal Privacy Rights at a company that uses Thrive TRM, LLC products to manage data that pertains to me? What does Thrive TRM, LLC do with data we collect? What types of data does Thrive TRM sell, and whom does it sell it? What are my rights in relation to my information? Request my personal data – CCPA Form Thrive TRM, LLC has always been committed to customers’ privacy rights, and our compliance with CCPA is a natural extension of that commitment. Below are answers to some commonly asked questions about Thrive TRM, LLC’s CCPA compliance and our privacy policy in general. Is Thrive TRM, LLC CCPA Compliant? Yes, Thrive TRM, LLC is CCPA compliant, both as a trusted data controller and as a trusted data processor. As a business focused on a great experience for our customers, we need to collect and store certain data about our users in order to properly serve them. However, our privacy policy and internal process are designed to limit the dissemination of any personal information beyond the business systems required to service our customers. Our business systems are all third-party data processors that guarantee their ability to implement the technical and organizational requirements of the CCPA. Built onto these policies and systems are CCPA-specific processes to execute CCPA-related transactions upon the request of any person that has done business with Thrive TRM, LLC. How does Thrive TRM, LLC protect users’ privacy and keep that information secure? As a SaaS company, we take your personal data very seriously issues associated with information security, including keeping private the personal data of our users, customers, partners, and employees. Our approach to securing personal data is based on both following the guidelines of United States National Institute of Standards and Technology Cyber Security Framework and the mandates of the California Consumer Privacy Act (CCPA). We employ a combination of best of breed cybersecurity products, including our own, together with a comprehensive set of internal policies and procedures to collect, store and restrict access to all personal data. Is the Thrive TRM, LLC CCPA policy specific only to Californians? Its more than just Californians. Thrive TRM, LLC’s privacy policy applies to all the parties (customers, prospects, partners, vendors, employees, etc.) we work who are within California’s CCPA regulatory scope. How can I exercise my Personal Privacy Rights with Thrive TRM, LLC? The thrivetrm.com website.com provides a link to “Request My Personal Data” form that allows users who have interacted with Thrive TRM, LLC to request Thrive TRM, LLC to delete, restrict, access, and/or rectify your data. This page is a person’s starting point for all data privacy-related transactions between you and Thrive TRM, LLC, the company. These requests can also be made by sending an email to: contactus@thrivetrm.com. How can I exercise my Personal Privacy Rights at a company that uses Thrive TRM, LLC products to manage data that pertains to me? If you interact with a company that uses Thrive TRM, LLC products to manage data, and you want to exercise your privacy rights as it relates to that data, you must contact the company that manages your data; i.e. Thrive TRM, LLC’s customer. Thrive TRM, LLC provides tools and services to our customers that allow them to manage the data on our systems to comply with CCPA. What does Thrive TRM, LLC do with data we collect? Internally, Thrive TRM, LLC uses industry leading, CCPA compliant systems and processes to manage our relationship with our customers, typically businesses, and the people representing those businesses; these are Marketing systems, Sales systems, and Support systems that all use some personal data to better serve our user community. Externally, Thrive TRM, LLC hosts several products that, by the nature of the services the products provide, collect some user data. For products and services available to the general public, our systems anonymize any user data we collect, so that any person accessing this data does not get access to any personal information associated with that data. For products and services that are used by business entities to manage user data, any data collected and stored on our systems is only accessible to that specific business, and we provide those businesses the tools and processes required for them to be CCPA compliant Thrive commits to attempt to resolve any complaints about our collection or use of your personal data. California residents with inquiries or complaints regarding CCPA Policy should first contact Thrive using the contact information provided in the “contact information” section below. Thrive’s compliance obligations are subject to investigation and enforcement by the U.S. Federal Trade Commission. What types of data does Thrive TRM sell, and to whom does it sell it? In the terms specified by the CCPA, we sell the following categories of data when we are engaged to perform research-related activities by contract to our partner companies. These categories of information include (as noted here) Section 1798.140 Item (o) (1): Identifiers, Customer records information, Professional or employment-related information, Education Information (as it relates to self-reported resume data), Inferences (as it relates to work history) In the last 12 months, we have sold this sort of information to a subset of our customer companies as a part of our research engagements. Due to privacy information required in our contracts with our partners, we do not display the names of specific companies here, but you may request a report of to whom your data was sold via our CCPA FAQ page. What are my rights in relation to my information? You have the following rights regarding your Personal Data which you can invoke by filling out this form and following the steps described there. Below is a summary of your rights: 1. Right to know what personal information is being collected about the individual. You have the right to access your Personal Data that we hold about you, i.e. the right to require free of charge: information whether your Personal Data is retained, access to duplicates of the Personal Data retained, Upon your request, along with a duplicate of the data we retained, we will provide you information related to – purpose of the processing, personal data we collect, entities to which we transferred them, time we keep your Personal Data, if possible, and the criteria we used to decide the period, your rights as a California resident under CCPA, unless the data was collected directly from you, the source of the data, and whether there is an automated decisional process, If the effort of identifying data may be too much, or it may infringe the rights of other people, we have the right to refuse your request, in which case you may file a complaint with a supervisory authority or invoke a dispute resolution process as described below. 2. Right to access the data. When we process your Personal Data, we shall try to ensure that your Personal Data is accurate and up to date for the purposes for which it was collected. If your Personal Data is inaccurate or incomplete, you can change the information or can request it be changed by contacting Thrive. 3. Right to know who your data is being sold to. You have the right to request to know to whom your data is being sold, with or without deletion of the data we have collected where one of the following applies: the accuracy of the personal data is contested by the individual covered under CCPA, for a period enabling the individual time to verify the accuracy of the personal data. the processing is unlawful, and the California resident opposes the erasure of the personal data and requests the restriction of their use instead. the processor no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims. 4. Right to opt out of those sales. You have the right to opt out of the sale of data concerning your personal data. These requests can also be made by sending an email to: contactus@thrivetrm.com or or by requesting opt out via the thrivetrm.com website. 5. Right to have your personal data removed. If we delete your Personal Data, you may lose access to Thrive TRM, LLC services which require creation and registration with us of a user account (“User Account”) by you. In some cases, deletion of Personal Data used to create the User Account, is complicated. Namely, if your User Account has a commercial business relationship with Thrive TRM, LLC (in other words, a relationship where you are making payments to us or we are making payments to you), you will only be able to obtain deletion by us your Personal Data after you and Thrive TRM, LLC have dissolved the commercial business relationship associated to that User Account. In some cases, considering the complexity and number of the requests, the period we take to delete your Personal Data may be extended, but for no longer than two months after the dissolution of the commercial business relationship.